The present invention relates generally to apparatus for securing the integrity of a system, and more particularly to electronic apparatus having a primary device such as a secure microprocessor for performing a function and a secondary device adapted for simulating that function and securing the function of the primary device.
The pirating or unauthorized interception of one's property can be a substantial threat to, e.g., a producer of services. For example, the unauthorized receipt of transmitted television programming incurs a substantial cost in lost profits to a satellite television or cable television (CATV) company. To protect against the pirating of a transmitted digital signal, encrypting devices using encryption codes have been developed for digital encryption of the signal. However, pirates can sometimes break the encryption by, e.g., attacking the hardware which performs the encryption function.
One way that encryption hardware has been compromised by intruders is via high-speed clock pulsing attacks on very large scale integration (VLSI) microprocessor circuitry used by the encryptor. A certain common aspect of VLSI microprocessor circuitry has been suspected of being vulnerable to these high-speed attacks. This aspect is known as "precharge" and refers to a minimal-area circuit design technique that connects data busses and shared control lines inside a VLSI microprocessor. It is believed that high-speed clock pulsing affects the operation of this type of circuitry.
Precharge acts like a time-sliced wired-OR bus for data. During some initialization time period, the data line is forced to a logic state that is opposite to the data state put onto the line by the multiple drivers used. This logic state is usually a one, or high voltage level. Following this initialization or precharge period, one of many driving data sources is allowed to pull the line low if a zero is the data bit state to be placed on the bus. Of course, there is no need for a data source to drive a logic one onto the line if it is precharged high, since the line has already been initialized into that state.
One way to detect an intruder involves monitoring the behavior of the "primary" circuit to be protected, e.g., a microprocessor, during this precharge period. If the primary circuit should be at a particular state, e.g., high or low, and it is not, then an attack may be occurring. However, it is very difficult to detect errant behavior of a complex device such as a microprocessor without adding a tremendous amount of dedicated circuitry for this purpose.
Accordingly, it would be advantageous to provide a relatively non-complex means that is useful for detecting the errant behavior of a primary device. It would also be advantageous to provide a low-cost means for detecting errant behavior. It would further be advantageous to detect an intruder attempting to withdraw information contained in a device and, in response, to secure the information and thereby prevent its loss.
The present invention provides an apparatus having the aforementioned advantages. In particular, the apparatus of the present invention provides a "secondary" device which simulates the vulnerability associated with a function of a primary device. Upon a breach of the simulated vulnerability provided by the secondary device, the latter will secure the primary device. Thus, a relatively inexpensive and non-complex apparatus is provided for securing a complex functioning system.